Exposing the Internet-Connected Infrastructure of the John Podesta Phishing Campaign - 
An OSINT Analysis 
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We’ve decided to take a deeper look inside the Internet-connected infrastructure of the John 
Podesta phishing campaign using WhoisXML API's vast real-time and historical WHOIS 
database with the idea to assist U.S Law Enforcement and the security industry on its way to 
properly attribute the campaign including to monitor and track down and respond to current and 
upcoming fraudulent and malicious campaigns courtesy of the same cybercriminals. 
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Sample cyber attack campaign attribution chain: 


hxxp://myaccount.google.com-securitysettingpage.tk - 195.20.46.133 Email: 
joost.zuurbier@verotel.com (http://www.pusztasoftware.tk - Email: pusztasoftware@gmail.com) 
- Puszta Software ; id9954.gq - 80.255.12.237 Email: myprimaryreger@gmail.com 
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Sample domains known to have been involved in the campaign include: 


google.com-changepasswordaccount.cf 
google.com-changepasswordaccount.gq 
google.com-changepasswordaccount.ga 
google.com-changepasswordaccount.ml 
google.com-changepasswordaccount.tk 
com-securitysettingpage.ml 
com-securitysettingpage.tk 
com-securitysettingpage.cf 
com-securitysettingpage.ga 
google.com-securitysettingpage.ml 
google.com-securitysettingpage.tk 
google.com-securitysettingpage.cf 
google.com-securitysettingpage.gq 
com-securitysettingpage.gq 


Sample known responding IPs known to have been involved in the campaign include: 


80.255.12.237 
198.105.244.111 
198.105.254.111 
195.20.46.133 
23.202.231.167 
141.8.224.221 
104.239.213.7 


Sample related domains known to have been involved in the campaign include: 


zurl.gq 
template.gq 
purityxcheats.gq 
dropcoineuro.gq 
c6h1206.gq 
freestuff4you.gq 
happyanniversaryvikasandpurvi.gq 
verotel.cz 
wouf.gq 
backspace.gq 
b-2-b.gq 
cerveja.gq 
ketda.gq 
techstop.gq 
quotesdaily.gq 
nielsen.gq 


honored.gq 
rentalzone.gq 
bitcoinpayment.gq 
my-server-online.gq 
beautyguru.gq 
newstrending.gq 
findiphone.gq 
alit.gq 

verotel.tv 
ticketsclub.tv 
technobuzz.gq 
bazin.gq 
sanjay.gq 
rickroll.gq 
buybitcoins.gq 
balthazar.gq 
pornoindir.gq 
muze.gq 

mops.gq 

griya.gq 
amibroker.gq 
beanies.gq 
dokuontheways.gq 
codeweb-nghichchoi.gq 
avvocato.gq 
cyro.gq 
mybitcoins.gq 
askfm.gq 
baumann.gq 
bitcoinpay.gq 
bariloche.gq 
pipo.gq 
krisleyramirez.gq 
live-sport.gq 
instagramnotify.gq 
amala.gq 
btc2earn.gq 
bcat.gq 
sinatabrizi.gq 
thebitcoincloud.gq 
mmsk.gq 
gmentr.gq 
callector.gq 
dolgov.gq 


ticketsclub.de 
videosonlinefullhd.gq 
starmusic.gq 

sachi.gq 
laschicasdelhot.gq 
flekzer.kim 
yourdfwhandyman.gq 
qqhok.gq 
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angelbeats.gq 
prmdin.gq 

helm.gq 
cheap-room.gq 
melanie.gq 
vinayak.gq 
techidea.gq 
tattoosinkedgirls.gq 
dapcraft.gq 
bursaescortbayan.gq 
btcearnings.gq 
redtv.gq 
hemmeligflirtforste.gq 
bitcoinbreakingnews.gq 
aylin.gq 
watch-series.gq 
webreport.gq 
richlife.gq 

rbmnet.gq 
piotrowski.gq 

raju.gq 

limitless.gq 

jiggles.gq 

gona.gq 
bestphones.gq 
aidenk.gq 
summerbreezeduo.gq 
galaxy-worlds-contact.gq 
downloadlinks.gq 
gokrs.gq 
danielraxygroupcompany.gq 
amanneo.gq 

baika.gq 
cameraman.gq 
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habborp.gq 
armenia.gq 
arabanis.gq 
warfram.gq 
travelmate.gq 
techsoftfree.gq 
star-rooms.gq 
ketab.gq 
blocker.gq 
winnerintrom.gq 
Zous.gq 
wepost.gq 
txttest.gq 
scraphook.gq 
apuestas.gq 
bitkoin.gq 
cupcake.gq 
trashcan.gq 
tribune.gq 
newforssres.gq 
mbmail.gq 
amateur-radio.gq 
afrereum.gq 
news4u.gq 
sparotophle.gq 
videoprimadesnudatotalxxx.gq 
pernasadumb.gq 
gaja.gq 
motupatlu.gq 
pitchforkunion.gq 
ccrisismanagement.gq 
indianintellects.gq 
itsvladonebaby.gq 
diagnostic.gq 
frvr.gq 
comcom.gq 
berry-cahn.gq 
prabalregmi.gq 
followerclub.gq 
dz4apk.gq 
starfompiesled.gq 
ticondosi.gq 
estitame.gq 
ifinsanfi.gq 


anaragab.gq 
treakapraythe.gq 
midenifi.gq 

cmbc.gq 

hacknazi.gq 
epanimad.gq 
liondomino.gq 
magenvicon.gq 
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188domino.gq 
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nhz3ds.gq 

appnet.gq 
charlatan.gq 
my-project.gq 
info-terkini.gq 
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33132333331 .gq 
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mimejorvideoxxxnudestotal.gq 
josefdreamz.gq 
weddingparty.gq 
kronsocceragency.gq 
clubhealth.gq 
asgaccse-pt.gq 
videoxxxseprostituyoporuncelular.gq 
shapes-crib.gq 
photobox.gq 
paidclub.gq 
boosted.gq 


4ktv.gq 
breakthrough.gq 
brocker.gq 
room-services10.gq 
humanright.gq 
dominic.gq 
bestfilm.gq 

bengali.gq 
obbercraft.gq 
hoshen.gq 

fpt-cks.gq 

ebal.gq 
shopwithme.gq 
vecinasperrasxxxsalvador.gq 
probate.gq 
catcare.gq 
boombang.gq 
showme.gq 
jikonal.gq 

farming.gq 

biasfg.gq 
emailrj29.gq 
wp-demo.gq 
shopcart.gq 
vecinavideoscaptadosxxx.gq 
qooqle.gq 

ravage.gq 

krylov.gq 
glowingqueen.gq 
expricenceportalbegin.gq 
bestwallpapers.gq 
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privatejets.gq 
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foogle.gq 
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checkback.gq 
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canlitv.gq 
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smeta.gq 
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ticketsclub.pt 
tclubroom.org 
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sbdv.org 

veroteltv.net 
tclubroom.net 
visamemberagent.com 
visup.com 
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cardbilling.org 
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croft.gq 
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drem.gq 

educ.gq 
alpahatack.gq 
burak.gq 

siti.gq 

mziq.gq 
powerbank2018.gq 
galerie.gq 
iglesiabautistafundamentalibague.gq 
corporalpunishment.gq 
cryptoworld.gq 
crowntrades.gq 
roseandcoal.gq 
vurls.gq 
swissgolden.gq 
suman.gq 
taitai.gq 
technerd.gq 
sanket.gq 
solution4u.gq 
kissk.gq 

lilian.gq 
julia-polezhayeva.gq 
hotsales.gq 
fashionarena.gq 
ezee.gq 
btc-pm.gq 
computertech.gq 
chick.gq 

climb.gq 

biju.gq 
aboalmig2017.gq 
zcms.gq 

storp.gq 
shades.gq 
samtech.gq 
beryl.gq 

bair.gq 


ashirbad.gq 
youer.gq 
what-type-of-home-insurance-do-i-need.gq 
watchme.gq 
viswa.gq 
twoh.gq 
topsecret.gq 
tadebook.gq 
royalacademy.gq 
sabjiwale.gq 
nitinsharma.gq 
lowifi.gq 
karim.gq 
lifestory.gq 
khmer.gq 
girlsex.gq 
emwinyi.gq 
offerbd.gq 
getphoenixforayear.gq 
igflex22root.gq 
naxe.gq 

buru.gq 
various.gq 
vedant.gq 
sikora.gq 
shiftlog.gq 
rams.gq 
mujereshot.gq 
luisantonio.gq 
mehmetusta.gq 
signalforex.gq 
ussmelodies.gq 
ramakrishna.gq 
newsforyou.gq 
buddhodev.gq 
helps.gq 

aZzi.gq 
williams.gq 
xenn.gq 
subhumancockroaches.gq 
videohotenvivo.gq 
pugachev.gq 
gamings.gq 
hina.gq 


bullchat.gq 
dizzydevils.gq 
wygluszenie-drzwi.gq 
weblion7.gq 
uuuuUU.gq 
thomasrinaman.gq 
tidal.gq 
techprofessionel.gq 
sterzx.gq 

starz.gq 

sweb.gq 

snhrs.gq 

sulc.gq 

rice.gq 

radiolef.gq 
proworkfor.gq 
gatarnew.gq 
porto.gq 

apptee.gq 

rafan.gq 

livee.gq 
socialchat.gq 
vpnd5.gq 

libya.gq 
colonial-wars-realism-mod.gq 
vigrxplus.gq 
downloadmusik.gq 
morritassexihot.gq 
girlsvideoonlinehd.gq 
yujin.gq 

yura.gq 


yant.gq 
worldtnnnews.gq 


wolfbot.gq 
khaledbd.gq 
josir.gq 
instagramfreefollowers.gq 
jane.gq 
intube.gq 
gracecapital.gq 
goli.gq 
hackingland.gq 
hassi.gq 
futurestart.gq 


giftofdivineseed.gq 
freetonightformen.gq 
gemsinthecountrycrystals.gq 
gali.gq 

freecam.gq 
freehome.gq 
perasaanku.gq 
polit.gq 

patrik.gq 

outs.gq 

moss.gq 
moviespro.gq 
myhottblog.gq 
merch.gq 
movieshub.gq 
moscowtaxi.gq 
minor.gq 
moment.gq 
midea.gq 
meinblog.gq 
mansi.gq 
lilboom.gq 
404internetdrive.gq 
bodyfitness.gq 
seyulae.gq 
roomstar.gq 
2dayfree.gq 
myservers.gq 
kaur.gq 
giahannoptokhaithue.gq 
preet.gq 
stripchat.gq 
gofastlead.gq 
aleeblogs.gq 
anand.gq 
room-parking.gq 
girlsvideosononline.gq 
werty.gq 

foclub.gq 
endha4.gq 
evanissavage.gq 
eeon.gq 
dominion.gq 
defacto.gq 


cookiew.gq 
brandedsms.gq 
caricara.gq 
chae.gq 
bestgadget.gq 
bacaberita.gq 
affiliation.gq 
alg-off.gq 
appdev.gq 
2051034002.gq 


iiiiii.gq 
jalansempit.gq 


idragon.gq 
inta.gq 
girls4you.gq 
getfreewatches.gq 
getit.gq 
ganter.gq 
fatum.gq 
ecraft.gq 
divan.gq 
concac.gq 
course.gq 
colleges.gq 
whephot.gq 
statements.gq 
thunderstorm.gq 
shiv.gq 

stas.gq 
tanish.gq 
smartinvestment.gq 
peyi.gq 
powermusic.gq 
replay.gq 
photo-art.gq 
newca.gq 
movo.gq 
monk.gq 
mandi.gq 
justwatch.gq 
shawn.gq 
repair.gq 


moviedroid.gq 
mart.gq 
luka.gq 
jose.gq 
jessie.gq 
epbpu.gq 
exgaming.gq 
cpec.gq 
cooncastle.gq 
betterddb.gq 
appt.gq 
alles.gq 
sportboys.gq 
shiyan.gq 
marisha.gq 
millioner.gq 
lindencroft.gq 
kitty.gq 
king9.gq 
hacktool.gq 
dominick.gq 
dept.gq 
btube.gq 
caring4seniors.gq 
bonanno.gq 
baynetug.gq 
yourname.gq 
yanshen.gq 
smartcart.gq 
sigit.gq 
sander.gq 
reddy.gq 
thegames.gq 
nextvideosmovil.gq 
marketshop.gq 
mete.gq 
spiritual.gq 
freedoge.gq 
13377331.gq 
pornoscript.gq 
learntocode.gq 
tgibank.gq 
pOxpwn.gq 
geekgrade.gq 


webroot.gq 
earningtricks.gq 
sankar.gq 
satya.gq 
rambler.gq 
sandbox.gq 
ranna.gq 
power-host.gq 
nepal.gq 

libre.gq 

Ipage.gq 
kirarashop.gq 
kampret.gq 
kasa.gq 

hama.gq 
fpehealthgroup.gq 
creditcards.gq 
tribes.gq 

geom.gq 
freelive.gq 
bOmb.gq 

elim.gq 
checkinfo.gq 
clanrules.gq 
clanmembers.gq 
hostgostrumbto.gq 
chukysodientu-cskh.gq 
getmelove.gq 
gagnerungalaxys8.gq 
ajtrick.gq 
androidtutor.gq 
kingsofwars.gq 
roompik.gq 
deev.gq 
clanevents.gq 
hoto.gq 
fpt-token.gq 
9to5inc.gq 
claninfo.gq 
qihaoda.gq 
redeemcode-garena.gq 
9501323016888.gq 
clanallied.gq 
onshop.gq 


xander.gq 

ufuk.gq 

samo.gq 

sheik.gq 
molodost.gq 
godspurposechurch.gq 
rogeter.gq 

mirra.gq 
bestonlinedegree.gq 
arventia.gq 
jabalalkhair.gq 
ddmaterial.gq 
dienormale.gq 
uras.gq 

nethub.gq 
raghavthapar.gq 
beautyproducts.gq 
macgc.gq 
mp4veiwers.gq 
movieu4khd.gq 
wallhackpro.gq 
jardinpequenosgeniossucre.gq 
skyworldpictures.gq 
india.gq 
elementary.gq 
stereohitzfm.gq 
bitcoin6.gq 
bitcoin2.gq 
slasetan.gq 
bitcoin7.gq 
bitcoin5.gq 
bitcoin4.gq 
dirtyquestionstoaskaguy.gq 
simpson.gq 
jornalismo.gq 
questionstoask.gq 
bitcoin3.gq 
tripleclicks.gq 


Related sample responding IPs known to have been involved in the campaign include: 
177.247.182.246 


76.223.26.96 
81.17.29.148 


87.236.215.99 
216.245.213.75 
13.248 .148.254 
212.32.237.101 
217.160.0.31 
63.141.242.45 
54.72.130.67 
209.99.40.224 
185.10.58.170 
104.239.213.7 


We'll continue monitoring the campaign and will post updates as soon as new developments 
take place. 


